flows: acceptance argv is mutable by the implementation agent (drive-local class fix)

[kjgbot]

Summary

Following flows#244 (pinned-Git gate inputs, merged today as 90edeb0), the acceptance-input bypass class problem still exists: arbitrary argv can invoke a check script that the implementation agent has edited. Captured probe reports PACKAGE_VERIFIED while IMPLEMENTATION=broken. The pinned-Git work addresses TRUST OF INPUTS, but not IMMUTABILITY OF THE VERIFICATION CONTRACT itself.

Filed as the follow-up per the merge-decision discussion: pin-Git is real progress and shipped; this issue tracks the remaining class fix.

Repro (captured on flows#244 pre-merge)

• Committed src/value.txt = broken.
• Package metadata declares src/value.txt in scope, requires it to become fixed.
• Uncommitted edit to outside.txt.
• Run the report helper on the fetched head unmodified.

Actual: PACKAGE_VERIFIED, exit 0, git diff --stat prints the out-of-scope edit but the DoD strings are printed-not-asserted.

Expected

The verification argv is treated as an immutable contract. Either:

1. Immutable-inputs shape: acceptance scripts and their args are declared once in the package and cannot be modified by the implementation lane. The runner reads them from a pinned source (git ref or a separate worktree the implementation agent cannot touch).
2. Independent-workspace shape: acceptance runs in a preserved workspace containing only the DoD assertions, referencing the changed source but not being reachable to it — matches how CI runs against an artifact, not a mutable source tree.

Suggested direction

Option 1 is cheaper to land: add a verification block to the package manifest that names the acceptance script(s) by pinned-Git ref or by absolute path outside the implementation's writable scope. Refuse the verify step when the pinned ref is missing or the paths are inside the implementation-writable set.

Option 2 is stronger but requires a separate workspace primitive that the current drive-local runner doesn't have.

Acceptance criteria

• The Docker/PACKAGE_VERIFIED path exits non-zero when the argv points at a script that has been edited in the implementation lane.
• An isolated report against a fixture with an outside-scope edit exits non-zero with a diagnostic naming the DoD.
• Regression test reproducing the sweep's captured PACKAGE_VERIFIED while IMPLEMENTATION=broken fixture.

Context

Follow-up to flows#244 (90edeb0). Discussed in the 2026-09-10 launch-prep sweep (see PR-SWEEP-REPORT-0910.md §#242 for related evidence). The pinned-Git inputs from #244 address one axis; this issue tracks the other.